UBUNTU-CVE-2026-125230: Integer Overflow

Published Nov 10, 2026

Updated

FFmpeg through 9.0.2 contains an integer overflow vulnerability in the pcmrechunk bitstream filter that allows attackers to trigger division by zero via a crafted channel count. Attackers can supply a file declaring a huge channel count that is remuxed into MXF, GXF or DAUD, overflowing samplesize and crashing the application.

Affected Software

7 affected components

ubuntu/ffmpeg*

Event History

Nov 10, 2026

CVE Published

via OSV·12:00 AM

Data Sourced

via OSV·12:00 AM

DescriptionSeverityAffected Software

Frequently Asked Questions

Which workflows are exposed to this issue?

Workflows that remux attacker-controlled media into MXF, GXF, or DAUD are exposed when the pcm_rechunk bitstream filter processes the input. A crafted file can declare a huge channel count, overflow sample_size, and crash the application.

What does an attacker need to provide to trigger the crash?

The attacker needs to supply a crafted media file with a huge declared channel count and have it processed in a remuxing workflow targeting MXF, GXF, or DAUD. User interaction is required according to the supplied severity vector.

What is the impact of successful exploitation?

Successful exploitation causes a division-by-zero condition that crashes the application, resulting in availability impact. The provided vector indicates no confidentiality or integrity impact.

UBUNTU-CVE-2026-125230: Integer Overflow

Affected Software

Event History

Frequently Asked Questions

Which workflows are exposed to this issue?

What does an attacker need to provide to trigger the crash?

What is the impact of successful exploitation?

Company

Resources

Contact

Frequently Asked Questions

Which workflows are exposed to this issue?

What does an attacker need to provide to trigger the crash?

What is the impact of successful exploitation?